The debugging narrative: say what each check would mean, then what it ruled out
Debug aloud as a ledger: before each check, say what each result would mean; after it, say what it ruled out and what comes next.
Predict first
Before you read: predict
ExamHall debugging round; the interviewer plays the system. Since this morning's release, some proctors' live alert feeds stall. You named two explanations, the new console build or the feed server, and said: "If only one build stalls, it's the console; if every build does, it's the server." You asked for stalls by console build.
The interviewer: "Only console 4.2 stalls; 4.1 is fine." What do you say next?
The 30-second version
Say the signal, then two or three explanations. Before each check, say what each result would mean. After the reading, say what it ruled out and the next check; a check that finds nothing still rules something out. Asked where you are, give the ledger. Close with the fix, its verification and the prevention.
Debug aloud as a ledger: before each check, say what each result would mean; after it, say what it ruled out and what comes next.
How it works
Step 1 of 10
Analogy: The refrigeration engineer on the phone
At 2 a.m. a food warehouse's cold store reads two degrees over its limit. The on-call refrigeration engineer can't see the plant; the night supervisor is her eyes. "Two things usually do this: the compressor has stopped, or the coil inside has iced over. If the unit on the outside wall is silent, it's the compressor; if it hums, it isn't. Go and listen." "It's humming." "Good, so not the compressor. Now hold your hand at the blower inside: weak air means ice." "Weak, and the coil's white." "Then start a manual defrost and read me the temperature in twenty minutes. Tomorrow I'll check the defrost timer that should have stopped this."
| In the cold store | In the interview |
|---|---|
| The supervisor is her eyes | The interviewer holds every reading you ask for |
| Compressor or iced coil | Two or three explanations |
| "Silent means compressor; humming means not" | What each result would mean, said first |
| "Humming, so not the compressor" | What the reading ruled out |
| Read the temperature again after the defrost | Verify with the same reading |
| Check the defrost timer tomorrow | The prevention |
Breaks down when: the supervisor wants the store cold and doesn't care how she found it; an interviewer already knows the cause and scores how you narrow to it. Wrong inference: "only the right answer counts." And the engineer can drive over and look; you only ever see what you ask for.
In real terms: before each reading, say what each result would mean; after it, say what it ruled out and what is next.
Try it
Answer first, then check. Nothing is saved.
Question 1 of 7
Streaming debugging round. Since release 6.2, some viewers' videos fail to start. Your three explanations: the new player build, a new CDN edge rule that runs only on CDN B, or origin storage. You asked for failures split by CDN.
The interviewer: “Both CDNs fail at the same rate.” What do you say?
Question 2 of 7
Streaming debugging round, minute 12. Since release 6.2, some videos fail to start. You have asked for three readings: the request rate is flat against last week, failures are equal on both CDNs, and only player 6.2 fails, not 6.1. The interviewer asks you to pause there and say where you are.
What do you say?
Question 3 of 7
Streaming debugging round. Since release 6.2, some videos fail to start. You first suspected the CDN edge rule. You listed five explanations and the reading each one predicts:
explanation failures by CDN licence errors in player log failures by region
player 6.2 both CDNs none all regions
CDN edge rule CDN B only none all regions
licence server both CDNs many all regions
regional ISP both CDNs none one region
origin storage both CDNs none all regions
You asked for three readings, in this order. Failures by CDN: “both CDNs”. Licence errors: “none”. Failures by region: “all regions”. The interviewer asks what is still open.
Which answer is accurate?
Question 4 of 7
Streaming debugging round. Since release 6.2, some viewers' videos fail to start. Your three explanations: the 6.2 player, a stale manifest cached at the CDN, or origin storage. You propose purging the CDN's cached manifests. The interviewer agrees, then asks what the purge will tell you.
What do you say?
Question 5 of 7
Streaming debugging round: “Since Thursday's player release, some viewers get no subtitles. Walk me through it.” When you ask, the interviewer will say: subtitles are missing on old and new player versions alike; only on titles added since Thursday; and those titles' subtitle files are empty at the origin. Write what you would say, one line per part, each starting with its label, in this order: Signal:, Explanations: (two or three, separated by semicolons), then for each reading Check: (what each result would mean), Reading: and So: (what it ruled out, what is still open), then Fix:, Verify: and Prevent:.
Write the narration you would say, one labelled line per part.
Question 6 of 7
Notes from a streaming mock: “Asked why videos fail to start, he said at once, ‘Last month this was the CDN's TLS certificate,’ and spent 15 minutes on certificates before asking for a single split. It was the player.” He says he trusts his memory of incidents.
Which practice change fits?
Question 7 of 7
You are marking a recorded streaming mock. Since Saturday, some viewers' offline downloads stop before they finish. The candidate listed five explanations and what each predicts for two checks; “—” means the explanation allows any result there:
explanation failures by app version when downloads stop
9.4 pause-on-mobile rule 9.4 only —
phone sleep mode every version when the phone sleeps
CDN range requests — at a range boundary
download server overload every version —
licence token expiry every version after 30 minutes
The interviewer gave both readings: failures by app version, “every version”; when downloads stop, “after 30 minutes”. The candidate then had to say what the two readings ruled out.
Which line would have been accurate?
Go deeper
Pro tip
Practise with a partner who plays the system. Hand them a short incident card with the cause and three readings on it; they answer only the readings you ask for. Record it, then mark every reading after which you did not say what it ruled out.
Related lessons
- Read first: Debugging production systematically
- Related: The debugging method
- Related: Incident: 502s after a deploy (pool exhaustion, missing FK index)
- Related: Incident response and on-call
- Related: Narrating while you code
- Related: I don't know, but here's how I'd reason
- Related: The conceptual answer shape: say it, show how, then stop
Checked against the tools and docs as of 2026-10-06.